Facebook Open URL Redirection vulnerability

Security Researcher Dan Melamed discovered an Open URL redirection vulnerability in Facebook that allowed him to have a facebook.com link redirect to any website without restrictions. An open URL Redirection flaw is generally used to convince a user to click on a trusted link which is specially...

Japanese word processor 'Ichitaro' zero-day attack discovered in the wild

Japanese most popular word processing software 'Ichitaro' and Multiple Products are vulnerable to a zero day Remote Code Execution Flaw Vulnerability, allowing the execution of arbitrary code to compromise a user's system. According to assigned CVE-2013-5990, malicious attacker is able to gain...

JVN#71256611: ASP.NET vulnerable to open redirect

ASP.NET provided by Microsoft contains an open redirect vulnerability due to an issue in the login component. Therefore a web application that implements ASP.NET may be vulnerable. Impact The user who accesses the web application that implements ASP.NET may be redirected to an arbitrary website. ...

New Phishing attack targets Italian Postal and Financial service again

A phishing attack is a complex combination of technology and psychology. There are numerous ways in which people are being made fools and they can be conned by hitting on unsecured website links. Sophos experts detected this week an intriguing case of phishing against the Italian postal service...

DNN (DotNetNuke) < 6.2.9 / 7.1.1 Multiple Vulnerabilities

The version of DNN installed on the remote host is affected by multiple vulnerabilities : - The application is affected by a persistent cross-site scripting vulnerability because input to the 'Display Name' in the 'Manage Profile' view is not properly sanitized. CVE-2013-3943 - The application is...

Mailbox iPhone app vulnerability executes any Javascript from HTML mail body

Italian Researcher Michele Spagnuolo recently revealed a serious vulnerability in the popular Mailbox iPhone app. Mailbox is a tidy iOS the email app recently purchased by Dropbox, has a pretty wide-open hole that could allow bad actors to hijack your device. The flaw occurs in the latest version...

Mailbox iPhone app vulnerability executes any Javascript from HTML mail body

Italian Researcher Michele Spagnuolo recently revealed a serious vulnerability in the popular Mailbox iPhone app. Mailbox is a tidy iOS the email app recently purchased by Dropbox, has a pretty wide-open hole that could allow bad actors to hijack your device. The flaw occurs in the latest version...

New Mac OS Malware exploited two known Java vulnerabilities

A new Mac OS Malware has been discovered called OSX/Leverage.A, which appears to be yet another targeted command-and-control Trojan horse, that creates a backdoor on an affected user's machine. The Trojan named 'Leverage' because the Trojan horse is distributed as an application disguised as a...

New Mac OS Malware exploited two known Java vulnerabilities

A new Mac OS Malware has been discovered called OSX/Leverage.A, which appears to be yet another targeted command-and-control Trojan horse, that creates a backdoor on an affected user’s machine. The Trojan named 'Leverage' because the Trojan horse is distributed as an application disguised as a...

Pinterest Exploit exposes user information of 70 Million accounts

Security researcher Dan Melamed has found a serious Pinterest Exploit that exposed user's information of over 70 Million accounts. The security researcher Dan Melamed has found a Critical Pinterest Exploit that compromised the privacy of over 70 Million Users, the flaw allows hackers to view the...

CVE-2013-4955

CVE-2013-4955: Puppet Enterprise before 3.0.1 contains an open redirect in the login page via a URL in the service parameter, enabling attackers to redirect users to arbitrary sites and facilitate phishing. Impact is a web-redirect vuln; no exploit details provided. Mitigation: upgrade Puppet Ent...

Threat Outbreak Alert: Fake Secure Message Notification Email Messages on August 13, 2013

Medium Alert ID: 30401 First Published: 2013 August 13 19:58 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a secure message notification for the recipient. The text in the email message attempts to convince the recipie...

Daily Dot News portal hacked by Syrian Electronic Army with phishing attack

Pro-Assad hacker group the Syrian Electronic Army claims to have breached the online news portal "Daily Dot" and deleted an article with a caricature of Syrian President Bashar al-Assad. SEA hackers gave an advance warning to Daily Dot editorial team via twitter, said "Dear @dailydot, please remo...

Threat Outbreak Alert: Fake Payroll Document Delivery Email Messages on July 18, 2013

Medium Alert ID: 30144 First Published: 2013 July 19 13:03 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a payroll document attachment for the recipient. The text in the email message attempts to convince the recipient...

CVE-2013-2248

Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in a parameter using the 1 redirect: or 2 redirectAction: prefix...

Oracle Linux 5 : java-1.7.0-openjdk (ELSA-2013-0958)

The remote Oracle Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2013-0958 advisory. 1.7.0.25-2.3.10.4.0.1.el59 - Add oracle-enterprise.patch - Fix DISTRONAME to 'Enterprise Linux' 1.7.0.25-2.3.10.4.el5 - updated to newer IcedTea7-fores...

Threat Outbreak Alert: Fake Fraud Complaint Information Email Messages on July 3, 2013

Medium Alert ID: 29937 First Published: 2013 July 3 14:41 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages that claim to contain a complaint case claim notification for the recipient. The text in the email message attempts to convince the...

Samsung Galaxy S4 SMS欺骗漏洞

BUGTRAQ ID: 60756 Samsung Galaxy S是三星的Android系统的智能手机。 Samsung Galaxy S4在Cloud Backup功能中存在SMS欺骗漏洞，攻击者通过发送特制的SMS到受影响设备，利用此漏洞可进行网络钓鱼攻击。 0 Samsung Galaxy S4 厂商补丁： Samsung ------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：...

RHEL 5 : java-1.7.0-openjdk (RHSA-2013:0958)

Updated java-1.7.0-openjdk packages that fix various security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity...

Iranian Gmail users targeted by politically motivated phishing attack

Google says tens of thousands of Gmail accounts belonging to Iranian users have been targeted in an politically motivated hacking campaign in the weeks leading up to the country's closely watched presidential elections. For the last three weeks, the search giant said it has "detected and disrupte...